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defined in the configuration file and will display 
the results. If we want the program to work in an 
active way, we need to use some of the following 
parameters: 

■ -w: restart services in WARN status and send a 
notification (e-mail) for each one of them. 

■ -d: restart services in DOWN status and send a 
notification for each one of them. 

■ -wd: restart services in WARN and DOWN status 
and send a notification for each one of them. 

■ -all: restart all services independently of their 
status and send a notification for each service with 
WARN or DOWN status. 

■ -reboot: restart the whole system independently of 
service's status and send a general notification. 

Once the service status has been determined, and 
according to the parameter specified in the execution, 
the action carried out for each service will consist of 
that shown in Table 1. 

Furthermore, independently of the service's status, 
with the parameters -all and -reboot, a notification 
via e-mail is sent to the administrator about the 
performed action. 

Listing 3 shows a sample of SMART in action, 
executed from a console with parameter -d (recovery 
of services in DOWN status). 

Check Scripts 

There are some optional executables files, the 
check scripts, responsible for checking whether 
the monitored services really are operative and 
responding to petitions. These files are written in 
Shell (.sh extension) and Expect (.exp extension). 
Expect is a tool that requires Tel and allows 
for automation of interactive applications that 
use textual representation. 

These scripts could be written in any program¬ 
ming language, because only the exit status is 
taken into account. If it's not equal to 0, we 
suppose that there has been no answer or that 
the answer given by the service has not been the 
expected one. This means that a check script not 
only can monitor services, but it also can achieve 
any check that returns a Boolean value, for example, 
to check whether the size of a directory exceeds a 
certain value, whether the amount of logged users 
is greater than a desired number, whether a kernel 
module is loaded and so on (Listing 4). 

Files with the .nag extension are also Shell 
scripts, but unlike the former ones, they call an 
external program (plugin) passing to it the parame¬ 
ters received from check-service, following the 
order and format that the plugin expects. This 
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Table 1. Service Actions 


Status 

Parameters 

Action 

OK 

-all 

Restart the service 

WARN 

-w, -wd, --all 

Restart the service 

Send a notification relating to service 

-d 

Send a notification relating to service 

DOWN 

-d, -wd, —all 

Restart the service 

Send a notification relating to service 


checks the service and returns the information gathered to the 
check script, which will interpret and convert it into the exit status 
that check-service is waiting for (Listing 5). 

Plugins are programmed in C, Perl and Shell and belong to 
Nagios. Their sources can be downloaded independently of the 
Nagios distribution, and some of them require the additional 
installation of certain programs and libraries. 

Installation, Configuration and Usage 

Software requirements include the following: 

■ sudo: allows a user to execute a command as another user. This 
will be necessary if you are planning to allow a nonroot user to 
execute SMART. 

■ awk: a pattern scanning and processing language. SMART uses 
it and expects to find it at /bin/awk. If that's not your case, edit 
the check-service and smart files of the SMART distribution and 
modify the line where AWK= "/bin/awk" is specified. 

■ Nagios plugins: sources can be downloaded independently of the 
Nagios distribution, and some of them require the additional 
installation of certain programs and libraries. You can use the 
plugins distributed with SMART or download the newest ones. 

■ Some shell scripts (in the scripts directory of SMART) may require 
some specific commands to check some services, such as dig for 
dns, wget for Web services, nmblookup for nmbd (Samba), ntpq 
for NTP, Idapsearch for OpenLDAP and so on. The paths of these 
commands are defined in a variable at the beginning of each 
script, so you can change their location, use any other command 
that might work better for your system or even rewrite the 
whole script at your convenience. 

With sudo you can permit another user to run SMART. If you're 
not interested in creating such a user, you can omit steps 1, 2 and 
3 below. 

1. Create user sysman and group sysman. 

2. Create the SMART directory. It's a good idea to install it at sysman 
home and to set the appropriate owner and permissions: 


mkdir /home/sysman 

chown root:sysman /home/sysman 

chmod 750 /home/sysman 

3. Edit the sudo configuration file /etc/sudoers, and add the 
following lines: 


sysman hostname=(root) NOPASSWD: /home/sysman/check-service 
sysman hostname=(root) NOPASSWD: /sbin/reboot 

4. Download the SMART software. 

5. Untar and unzip the distribution: 
tar -zxf smart-X.Y.tar.gz 

6. Go to the distribution directory and copy the files to the destination 
directory. If you choose a destination different from /home/sysman, 
you will have to edit the smart file and modify the line where 
dir= "/home/sysman" is specified: 

cd smart-X. 

cp check-service /home/sysman/ 

cp smart /home/sysman/ 

cp host.conf.dist /home/sysman/host.conf 

cp services.conf.dist /home/sysman/services.conf 

cp -r scripts /home/sysman/ 

cp -r plugins /home/sysman/ 

7. Go to the destination directory, and check/set file permissions 
and owners: 

cd /home/sysman 

chown -R root:root check-service scripts plugins host.conf services.conf 

chown root:sysman smart 

chmod -R 700 check-service scripts plugins 

chmod 750 smart 

chmod 644 host.conf services.conf 

Configuration is as follows. First, edit the SMART host configuration 
file host.conf, and modify it according to your preferences (hostname, 
mail addresses, commands paths and so on). Then, edit the SMART 
services configuration file services.conf, and uncomment/modify/add 
any service/daemon you want to check. Every line describes one service, 
with the following semicolon-separated parameters: 

■ NAME (non-empty string): descriptive service name (for example, 
IMAP). 

■ process_name[:port] (non-empty string[:integer]): parent process 
name and its operational port (for example, couriertcpd:143). 

■ process_param (string): parameters of running process. Some 
services run with the same process name, so parameters are 
useful to distinguish them. For example, the parent process of 
Courier IMAP and POP3 is couriertcpd, but one is executed with 
the parameter pop3d and the other one with imapd. 

■ max_procs (non-empty integer): the highest number of running 
processes allowed (for example, 10). Leave it at 0 if what you're 
monitoring runs no processes (for example, disk space). 
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■ min_procs (non-empty integer): the lowest number of running 
processes allowed (for example, 1). Leave it at 0 if what you're 
monitoring runs no processes (for example, disk space). 

■ start_command (string): the command to start the service or 
script to be executed when the service is down (for example, 
/courier/I ibexec/imapd.rc). 

■ pid_file (string): pid file path (for example, /var/run/imapd.pid). 

■ sock_file (string): socket file path. 

■ start_mode (0/1): the service can be started/stopped by adding 
start/stop to the start command (1), or it may not be necessary (0). 

■ check_script (string): the name of the script used to check the 
service. This script has to be in the scripts directory (for example, 
imap.nag). 

Leave the parameters empty if they are not applicable, except 
NAME, process_name, max_procs, min_procs and start_mode, 
which can't be empty. 

Now, you should be able to run SMART as user root or sysman: 
/home/sysman/smart 

Try using -h to get more information about available parameters. 
Running SMART through crond might be a good thing. You can run it 
as frequently as you want, but doing it every five minutes seems to be 
reasonable enough. 

Conclusion 

SMART is an easy-to-install application (simply copying the program), 
is much simpler to configure than Nagios (adding a new element to 
monitor involves adding only one line in the configuration file), and 
SMART is flexible, allowing you to monitor any service or aspect of 
the system, and it is very effective. 

Our experience in a production environment with thousands of 
users tells us that it's inevitable that we will reach some peak periods 
in which the amount of requests received by a service goes beyond 
the capabilities of the system, and response time grows in a dramatic 
manner. The fact that the system detects this situation, before its 
own administrator, and solves it in five minutes, is a great problem 
solver and provides a perception of better service to users. 

After two years of running SMART on about 15 servers, we can say 
that its main contribution has been our peace of mind. It's wonderful 
having a colleague who is checking that everything works correctly 
24/7 and who informs you about troubles after they already have been 
solved (especially during the weekends). 
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A Basic Text-Based 
Recording Studio 

Forget the huge expensive mixers and create a recording studio in a Linux box. 

MATTHEW GEDDES 


ecasound 


hydrogen 


Whether you're into Metal, Jazz, Noise, Baroque or something 
in between, it is becoming more and more popular for artists to 
take on not only the roles of composer and performer, but also 
the roles of audio engineer, producer and even distributor of their 
own work. 

The capability and quality of Linux audio applications are very good 
and constantly improving. Support for high-end and low-end audio 
cards is also getting better all the time. Whether it becomes the domi¬ 
nant platform in the field is largely irrelevant—those of us who find 
the flexibility of Linux and open-source tools to be valuable now have 
a platform suitable for creating high-quality audio tracks. 

This article outlines a simple method, which may be built upon, 
for recording layered, multitrack recordings. In keeping with the 
Linux tradition, in this article, we discuss a number of small, 
command-line tools that perform very specific tasks very well. We 
then combine the power of each of these tools into a digital audio 

workstation. As you 
will see, using these 
tools in such a way, 
it is possible to 
overcome the (rare) 
shortcomings in 
some of these tools. 

The tools we cover 
here are Ecasound 
and JACK. The 
Hydrogen drum 
machine is men¬ 
tioned briefly too. 

We use no ALSA- or 
OSS-specific features 
directly, and either 
will do fine. In fact, 
for those who have 
lost their way and 
have strayed from 
the path to enlight¬ 
enment (kidding), 
these tools and 
techniques also work 
under CoreAudio 
on Mac OS X. 

Figure 1 shows how data flows between each of these components 
at a high level. 


JACK API 


Sound driver (ALSA/OSS) 


Audio controller 


Figure 1. Audio Data Flow 


Equipment List 

For the examples outlined in this article, any sound card will do. I 
even have performed some relatively acceptable recordings using the 
onboard Intel i8x0 sound device in one of my Linux laptops. However, 
the difference between lower-end audio controllers and the mid- to 


high-end ones is quite noticeable. 

We also require a Linux distribution. If you have trouble getting 
JACK and Ecasound for your distribution, try the AGNULA live 
distribution. Most distributions come with the relevant packages 
these days anyway. 

A mixer is desirable. Using a small (read: cheap) mixer may give you 
more flexibility and a chance at a better sound. You also may find that 
a direct injection box or a microphone preamp is adequate. 



Figure 2. Equipment Signal Flow 

Note that Figure 2 suggests plugging the headphones in to 
your Linux box. Most mixers allow the sound card to be plugged in 
to a signal return port and allow the headphones to receive the 
audio signal either before or after the signal is sent to the Linux 
box. This is acceptable too. 

Assumed Knowledge 

In this article, we don't assume much apart from the following: 

■ A Linux box with a configured and tested audio controller. 

■ The ability to source and install necessary packages and their 
dependencies. 

■ A familiarity with your choice of noise-making device (for example, 
guitar, cello, cat and so on). 

Starting jackd 

JACK, which stands for the JACK Audio Connection Kit, is an API and 
a service that provides audio connectivity between applications on 
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many POSIX-compliant systems. JACK has been designed with 
low-latency communication in mind. 

Many of the examples in this article may work equally well without 
JACK. I personally have had fewer audio dropouts on systems employ¬ 
ing JACK running with real-time priority than without, and it is quite 
useful for interconnecting audio applications, such as the Ecasound 
and Hydrogen example discussed later. 

For applications to make use of JACK, they must be linked against 
the JACK API libraries, and the JACK service, called jackd, must be 
started. Distributions shipped with JACK often already have most appli¬ 
cations linked against the JACK API. If not, consult the build or compile 
instructions for your given application. 

To start the JACK service, execute a command similar to the 
following: 

jackd -R -d alsa 

The -R option instructs JACK to attempt to attain real-time 
privilege, and -d alsa instructs JACK to use the ALSA sound sys¬ 
tem. For users still using the OSS sound system, -d oss should 
suffice, and -d coreaudio should get Mac OS X users off to a start. 

Each driver supports a series of driver-specific options. These may 
be viewed by specifying -help after -d alsa. 

Testing Audio Signal and Setting Levels 

Before leaping in too far and beginning to record audio, I strongly 
recommend spending some time getting the various settings and 
levels right. The good news is that this involves plugging the 
instrument of your choice in to the mixer or sitting it in front of 
a microphone and playing. 

Begin by getting the average signal coming into the mixer at 
around the OVU mark and try to avoid sending the signal into the red 
too often. Once the mixer levels are generally okay, connect it to your 
PC and check that the input level and output level are fine: 

ecasound -i jack_auto -o null -ev 


Second, check the maximum gain figure. This gives the percentage 
that this sample can be amplified (theoretically) before clipping starts 
to occur. Depending on your hardware, you may never get within a 
few percentages before you hear audible distortion, so it pays to 
leave yourself a little room until you're familiar with your hardware. 
Listen as you test. 

Once you have made mixer adjustments, try the previous few 
steps again. 

Once you're happy with the input levels, set the output level to 
a comfortable level for you to monitor using your headphones. 

Recording a First Track or 
Live Stereo Performance 

Ecasound is a command-line tool capable of multitrack recording 
and more. The basic concept key to using Ecasound is chains. For 
our purposes, you can consider chains to be similar in function to 
a patch lead in a patch bay. A signal enters one end of the chain 
from a sound source and exits the chain into another component. 
A patch lead has exactly one input source and one output destina¬ 
tion, and the same can be said about Ecasound's chain concept. 

Sources and destinations for chains in Ecasound are usually 
audio files or audio controllers. It is quite normal to have a complex 
set of chains. The first track we will record will see Ecasound take 
audio from the running JACK instance and write the data back to 
JACK, as well as keep a copy in a PCM audio file. The two chains 
we need to perform these tasks are shown in Table 1. 


Table 1. Chains for Our First Track 


Chain 

Input Source 

Output Destination 

1 

JACK 

JACK 

2 

JACK 

trackl.wav 


The -i jack_auto command-line option tells Ecasound to get its 
input from JACK. Because we're not running any other JACK-aware 
applications at the moment, JACK takes this input from the sound 
device. The -o null tells Ecasound to send output to the great bit 
bucket in the sky. 

The -ev option tells Ecasound to keep track of amplitude statis¬ 
tics, and the -c option starts Ecasound in interactive mode. With 
a little luck, you should see a few informational messages and no 
errors or warnings. 

Any percussive sounds (such as palm-muting on the guitar) 
are likely to cause a spike in your audio track. While checking the 
signal levels, use any of these techniques you intend to record 
later—it'll save a nasty surprise in the moment of creative genius. 
To stop, press Ctrl-C. You should be presented with output similar 
to the following: 


This equates to the following Ecasound command: 

ecasound -c -b:64 \ 

-a:1,2 -i jack_auto \ 

-a:l -o jack_auto \ 

-a:2 -o trackl.wav 

Once Ecasound has initialised, it prompts you for instructions. 
Use the t command to start recording/playing and s to stop. If you 
make a mistake, you can issue a stop (s), the setpos 0 command, 
and t to start again. The q command quits when you're done. 
There's no need to issue any kind of command to save the result— 
that happens as you record. 

The above command can be broken down into the following 
functions: 


(audiofx) 
(audiofx) 
(audiofx) 
(audiofx) 
(audiofx) 
(audiofx) 


Peak amplitude, period: pos=0.30495 neg=0.26996. 
Peak amplitude, all : pos=0.30495 neg=0.26996. 
Clipped samples, period: pos=0 neg=0. 

Clipped samples, all : pos=0 neg=0. 

Max gain without clipping, all: 3.27926. 

-- End of statistics - 


First, check that you have no clipped samples (positive or negative). 


■ -c: don't start processing immediately, instead enter interactive 
mode. 

■ -b:64: set the number of samples buffered to the smallest possible, 
reducing latency. 

■ -a: 1,2 -i jack_auto: create two chains (1 and 2) and set their input 
to come from JACK. 
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■ -a:1 -o jack_auto: set the output of chain 1 to JACK. 

■ -a:2 -o trackl .wav: set the output of chain 2 to trackl .wav. 

The overall result of this particular example is that chain 2 
records anything coming in through JACK (and therefore probably 
the sound card) to trackl .wav. Chain 1 allows you to hear the 
audio signal as it's being recorded. 


This chain setup translates into the following Ecasound command: 

ecasound -c -b:64 \ 

-a:l -i trackl.wav \ 

-a:2 -i track2.wav \ 

-a:3,4 -i jack_auto \ 

-a:1,2,3 -o jack_auto \ 

-a:3 -o track3.wav 


Overdubbing of Subsequent Tracks 

Unless you're recording a live stereo track, you're likely to want 
to overdub other tracks. It is possible to use Ecasound to listen to 
tracks you've already recorded while recording (and listening to) 
a new track. 

To listen to an already-recorded track while recording a second 
track, create three Ecasound chains (Table 2). 


Tahla 9 Phainc fr»r 1 ictoninn 


to an Already-Recorded Track While Recording a Second Track 

Chain 

Input Source 

Output Destination 

1 

trackl.wav 

JACK 

2 

JACK 

JACK 

3 

JACK 

track2.wav 


Recording a Software-Based Sound Source 

I'm not a drummer, but some of the things I record need drums. 
Although the Hydrogen drum machine is probably the best that I 
have seen on Linux, it hasn't yet attained the magical 1.0 version 
number and isn't yet perfect. One feature that's broken in the 
snapshot I'm running is the ability to export to a PCM audio .wav 
file. As luck, or rather good design, would have it, Hydrogen can 
use JACK to output digital audio. 

To use JACK and Ecasound to record the output of an audio 
application such as Hydrogen, we can perform the following steps: 

1. Configure Hydrogen to use JACK for its output. 

2. Configure Hydrogen to play in song mode, as opposed to 
pattern mode. 

3. Execute the the following command: 
ecasound -a:l -i jack_auto -o drum_track.wav -G 


Creating a chain setup like this causes the contents of trackl .wav 
to be sent to JACK to be played, and any input from JACK is sent back 
to JACK and saved to a file called track2.wav. track2.wav will contain 
only the new track—not the new track mixed with the old track. We'll 
mix them later. 

Converting this chain setup to an actual Ecasound command is 
straightforward: 

ecasound -c -b:64 \ 

-a:l -i trackl.wav \ 

-a:2,3 -i jack_auto \ 

-a:1,2 -o jack_auto \ 

-a:3 -o track2.wav 

Recording further tracks is a similar process. We create a chain 
for each of our already-recorded tracks and set their output to 
JACK. We also set up two chains to take input from JACK and 
send it to a file and back to JACK, so we can hear it. The chain 
setup in Table 3 would suffice. 


Table 3. Chains for Recording More Tracks 


Chain 

Input Source 

Output Destination 

1 

trackl.wav 

JACK 

2 

track2.wav 

JACK 

3 

JACK 

JACK 

4 

JACK 

track3.wav 


jack,ecasound,recv 

4. Click the play button in Hydrogen. 

The above command configures a single chain within Ecasound 
that draws input from JACK and sends output to a file called 
drum_track.wav. The -G jack,ecasound,recv instructs Ecasound to 
listen to JACK for a start command, which is sent when we click 
the play button in Hydrogen, as a JACK client called ecasound. 

It can take a second or so for Ecasound to start and initialise after 
receiving the start command, so I like to have a pattern of silence at 
the start of the Hydrogen track. 

Unless you have impeccable timing, you would most likely record 
any software sources first. It is harder to synchronise a software source, 
such as a drum machine, with an existing human-recorded track than 
it is to record the human tracks around the machine-created tracks. 

This includes any MIDI tracks you intend to use. 

Mixing All Tracks to a Single Stereo Master 

At this point, we have a series of .wav files that correspond to 
each of the audio tracks we have recorded. Should we need to, we 
could use Ecasound, SoX or even Audacity to add effects or make 


Table 4. Turning Multiple Tracks into a Single Stereo Master^^B^BHBSS 

Chain 

Input Source 

Output Destination 

1 

trackl.wav 

all_tracks.wav 

2 

track2.wav 

all_tracks.wav 

3 

track3.wav 

all_tracks.wav 
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You also can attach a series of effects, 
including reverb, compression and 
amplification to each chain before it 
is written to the output destination. 


minor corrections or alterations to any of the tracks. Once we're 
happy with the individual tracks, we can mix a single master track. 

The process of turning our multiple tracks into a single stereo 
master track is straightforward. We create a chain for each track 
and set the output to be a .wav file. 

Ecasound provides a means to make this particular case easier. The 
all pseudo-chain name can be used to redirect the output of all of our 
tracks to a single place, namely a file called all_tracks.wav: 

ecasound -a:l -i trackl.wav \ 

-a:2 -i track2.wav \ 

-a:3 -i track3.wav \ 

-a:all -o all_tracks.wav 


To listen to the result, enter: 

ecasound -a:l -i all_tracks.wav -o jack_auto 

It is also possible to write the master directly to the sound card 
without writing to a file first: 

ecasound -a:l -i trackl.wav \ 

-a:2 -i track2.wav \ 

-a:3 -i track3.wav \ 

-a:all -o jack_auto 

You also can attach a series of effects, including reverb, com¬ 
pression and amplification to each chain before it is written to the 
output destination. It is even possible to add delay and alter the 
panning of a particular track or even perform noise reduction; 
however, such topics are beyond the scope of this article. 

Summary 

As we have demonstrated, it is possible to create a simple multitrack 
recording using a handful of Linux audio tools. Once we started 
jackd, it was a simple process of telling Ecasound where to receive 
input from and where to send output to as we recorded our initial 
track and overdubbed a series of subsequent tracks. 

Each of these tracks has been stored in its own individual .wav 
file. This allows us to use any other soundfile editor to make manual 
modifications to the track before mixing a final track, which can 
then also be tweaked. Common applications for processing audio 
files include Ecasound, SoX and Audacity. 

We have really just scratched the surface of this particular aspect 
of a large field. With luck, it will form a solid foundation on which 
you can build your creative geniusla 

Resources for this article: www.linuxjournal.com/article/9269. 
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Building and Integrating 
a Small Office Intranet 

This "how we did it” story includes valuable tips for building an intranet that integrates 
enterprise services in a user-friendly way. 

DAVE JONES 


Intranets have been around for a long time. They were one of 
the first alternate uses for World Wide Web technology back in the 
early 1990s. The idea of bringing a little bit of the Web experience 
in-house was very attractive, but integration with existing systems 
was difficult. Thus, a lot of intranets were nothing more than glori¬ 
fied bulletin boards with some user-publishing features thrown in. 
The landscape is different now, with open-source software ready 
to take most of the cost and some of the complexity away from a 
good intranet setup. The so-called LAMP stack provides the perfect 
neutral platform for integrating many different pieces of software 
into a single point of interaction for users. That's what we have 
tried to do at our company. 

Our intranet started off in 1999 as a Web-based bulletin board 
and company calendar on a Red Hat 6.0 server running Apache. It 
was a static HTML site that was designed and kept current by our 
marketing manager. After she left the company in 2002, we needed 
to make the intranet more dynamic so that it didn't depend on 
one person to keep it up to date. As is usually the case, we added 
more and more features over the years and now have a very useful, 
user-friendly intranet site without a lot of unnecessary or static 
content that needs to be maintained. In this article, I use our 
intranet as an example of how to solve four of the more common 
integration tasks that small business admins may run into when 
setting up a LAMP-based intranet. 

Technical Overview 

Our intranet currently serves about 70 employees and runs on an IBM 
x335 server running Fedora Core 4. We use a normal LAMP stack 
(Linux, Apache 1.3x, MySQL and Perl) with mod_perl to improve per¬ 
formance. Apache currently shares the server with our e-mail scanner, 
internal DNS, Jabber, Samba and some other services. It's nice having 
all of this running on a single Linux server, because it reduces the need 
for NFS mounts and cuts down on network traffic. Some sites will be 
too large for this approach, but nothing in our design would preclude 



Figure 1. Flow Our Enterprise Services Are Connected 


it from working in a multiserver setup. All of our users run Windows 
XP and authenticate through Active Directory. We use GroupWise 
as our e-mail software running on a NetWare 6 server, and all of 
its information is handled by Novell's eDirectory. We also have a time 
and billing system that runs on a Windows NT 4.0 server and stores its 
data in a Microsoft SQL Server database. You can see a layout of 
how everything links together in Figure 1. 

Server-Side Credentialing 

We decided early on that our users shouldn't have to authenticate in 
any way to our intranet. The site should automatically "know" who 
they are based on their IP address and information gleaned from the 
network about who is currently logged in from that address. We call 
this technique server-side credentialing (SSC). We accomplished this 
originally by using a piece of custom-written client-side software that 
was contacted by a CGI script any time the server needed to check a 
user's identity. This works, but it places too much trust on the client 
side. A sniffer and a Perl script could fake a user's identity nicely from 
any client computer. We now use Samba and winbindd for this task. 

Because our intranet server resides on a trusted internal network, it 
is privy to the current state of affairs on the network, including who is 
logged in from where. Every computer in the office maps a drive letter 
to the Samba server during login, so any time the server needs the cur¬ 
rent user's identity, it simply looks up his or her IP address in the Samba 
connection list. The mapped drive is just a dummy drive explicitly for 
the SSC mechanism. I think this is an important feature, because it 
lowers the complexity of the site from a programming standpoint and 
allows users to browse freely without having to worry about registering 
or logging in. Users have enough user names and passwords to keep 
track of already without us adding to their burden. 

The way you set up SSC depends on how your users authenticate 
on your network. We use Active Directory, so that is what I demon¬ 
strate here. Active Directory is annoying (surprise, surprise), because it 
doesn't store connection status information in its directory. You must 
use traditional RPC calls with Samba's net command to get reliable 
results. Our SSC script is called smbconn.sh, and it looks like this: 

#! / b i n / s h 

net status sessions parseable \ 

| grep -i *\\\\$1\\\\" \ 

I sed 's/ A .n\\(.n)\\.n\.*\\.*$/\i/g' \ 

| sed 's/D0MAIN+//g' | tr -d ' 1 

Pretty simple, eh? Just remember to change DOMAIN to whatever 
your Active Directory's domain name is. This script returns the name of 
the user object that is logged in to Samba from the IP address we pass 
to it on the command line. The name it returns corresponds to Active 
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Directory's sAMAccountName property. Armed with this information, 
we now can run an LDAP lookup to get the user's full name or any 
other data we might need. The script we use to do this is found in 
Listing 1. It will take the user's sAMAccountName as its first argument 
and an optional attribute whose value you want returned as the sec¬ 
ond argument. If you don't provide the optional attribute, the script 
returns the user's full name. You could do all of this in a custom 
mod_perl handler so that its information always would be available, 
but this seems like overkill for most sites. Our site has only a handful of 
restricted sections where this information comes into play, so we just 
let each CGI script run it as needed. Here is a typical SSC call from 
one of our CGI scripts: 

##: Get this connection's user credentials 
my $remoteip=$ENV{'REMOTE_ADDR'}; 

open(SMBCONN,"smbconn.sh $remoteip |"); 
my $cn=<SMBCONN>; 

$cn=~s/\s+//g; ##: Strip whitespace 

close(SMBCONN); 

open(GETEMPINFO,"getempinfo.pi $cn |"); 
my $username=<GETEMPINFO>; 
close(GETEMPINFO); 
if($username eq "") { 

$username="Guest"; 

} 


appropriate personal information from the LDAP directory and proceed 
to assemble a My Intranet area in this section of the home page where 
the user can edit his or her employee profile, control mail preferences 
and so forth. The get_emp_card($cn) routine simply looks up the user's 
current info in Active Directory and returns a nicely formatted HTML 
section to display it (Figure 2). 

Active Directory Integration 

Another valuable addition to our intranet was integrating it with our 
Active Directory user database via LDAP. We use this to provide a com¬ 
pany directory that lists all of our employees. The directory is built in 
real time whenever it is accessed, and that is a major time-saver for 
administrators. Whenever new users are added using the normal Active 
Directory tools, they instantly show up in the intranet directory. We also 
allow our users to edit their own personal information, and those edits 
are put into the Active Directory by the CGI script. The process is relatively 
straightforward, although there are some things to take into considera¬ 
tion. Let me walk you through the process of how we set this up. 

The first thing we do is create a proxy user called proxyuser in 
Active Directory. This is the user name our scripts use to authenticate 
with LDAP. The proxy user is granted rights to read and write informa¬ 
tion on user objects within the ou=Domain Users container. That's all 
that needs to be done within Active Directory. We use Perl for our 
CGI, so that means using Net::LDAP. Here is how we connect to 
Active Directory from within a CGI script: 


This section of code leaves us with the user's 
sAMAccountName in the $cn variable and the user's 
full name in the $username variable. If the $username 
variable contains Guest, either the lookup failed or 
the computer accessing this CGI script doesn't have a 
logged-in user operating it. We now can use this critical 
information to decide whether the user has access to 
the information this CGI script is meant to provide. 
We also can use this information to return a page 
customized for this particular user. I demonstrate this 
with a section of code from the index.cgi file that serves 
up our home page: 


##: My Intranet section 
my $mint=""; 

if (($username eq "Guest") || ($username eq "")) { 
open(EMPSNAP,"./random-employee.pi 2>&1 |"); 
my @snap=<EMPSNAP>; 
close(EMPSNAP); 

$mint.=]'oin("\n" ,@snap) ; 
chop($mint); 

} else { 

$mint.=&get_emp_card($cn); 

$mint.="<b>E-Mail Controls:</b><br>\n"; 
$mint.="<a href=’selfserv.cgi'>My Mail</a>\n"; 


} 


Ultra Dense, Powerful, Reliable... 
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print STDOUT $mint; 

You can see here that we check to see if the person 
viewing the home page is actually a credentialed user. 
If he or she is not, we serve up a random employee's 
picture and profile in this section of the home page. 
If the person is a credentialed user, we grab the 
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Listing 1. 

getempinfo.pl 


#!/usr/bin/perl -w 
use Net::LDAP; 
use strict; 

my $cn=$ARGV[0] || "none"; 
my $attr=$ARGV[l] || "none"; 

##: If nothing was given on command line then return 
if($cn eq "none") { 

print STDERR "ERROR: No LDAP cn given\n"; 
exit(1) ; 

} 

##: Bind anonymously to the Idap database 
my $ldap=Net::LDAP->new('directory.domain.com',timeout=>5) 
or die "Couldn't connect to directory server.\n"; 
my $mesg=$ldap->bind('proxyuser@domain.com',password=>'proxyuser') 
or die "Couldn't connect to directory server.\n"; 

##: Query LDAP to get a list of employees 
if($attr ne "none") { 

$mesg=$ldap->search( base=> "ou=Domain Users,dc=domain,dc=com", 
filter=> "(sAMAccountName=$cn)", 
attrs=> [ 1 givenName','sn',"$attr"] ); 

} else { 

$mesg=$ldap->search( base=> "ou=Domain Users,dc=domain,dc=com", 
fi1ter=> "(sAMAccountName=$cn)", 
attrs=> [ 1 givenName','sn'] ); 

} 

my $count=$mesg->count(); 

($count==l) or die "Error: LDAP enumeration error."; 

my $entry=$mesg->entry(); 
my $value; 
my @values; 
if($attr ne "none") { 

$value=""; 

@values=$entry->get_value("$attr"); 
my $ i = 1; 
for(@values) { 
if($i>l) { 

$value; 

} else { 

$value.=$_; 

} 

$i++; 

} 

} else { 

$value=($entry->get_value('givenName')." "; 
$value.=$entry->get_value('sn')); 

} 

##: See if that attribute was defined for the given cn 
if(!(defined($value))) { 

print STDERR "ERROR: That attribute was not defined.\n"; 
exit(1) ; 

} 

$mesg=$ldap->unbind; 
print("$value\n") ; 


My Intranet 
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Figure 2. A Sample User Profile on the Intranet 


##: Active Directory connection 
use Net::LDAP; 

my $ldap=Net::LDAP->new('adserver.domain.com'); 
my $mesg=$ldap->bind('proxyuser@domain.com' , 

password=>'proxyuser' ); 

Notice the syntax that Active Directory requires for the user name 
field. It's one of the unique requirements of Active Directory's LDAP 
interface. Now that we are connected to the directory, we do a query 
to find all the user objects in the ou=Domain Users container: 

##: Query LDAP to get a list of employees 
my $basedn="ou=Domain Users,dc=domain,dc=com"; 
my $filter=" (objectClass=user)"; 

$mesg=$ldap->search( 
base=> Sbasedn, 
filter=> $fiIter, 
attrs=> ['givenName','sn','mail', 

'telephoneNumber','streetAddress', 

'1','st','department','postalCode', 

'employeeNumber','homePhone', 

'titie','sAMAccountName' ] 

); 
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This returns all of the user objects in that container, along with 
all of the pertinent attributes you would expect to find in a company 
directory. We now can refine our search filter to limit our search to 
only those users whose last name starts with a letter passed to the 
CGI script in its URL. This allows us to follow an address-book format, 
so we don't have to display all 70 users at once. We fall back to the 
letter a if no letter was asked for in the URL: 


##: Get letter requested in the URL 
my $letter; 

$letter=param(’letter') || "a"; 

my $filter="(&(objectClass=user) (sn=$letter*))"; 

If you aren't familiar with the syntax used by LDAP search filters, 
I suggest you look over RFC-2254. At this point, we can iterate 
over our query results and prettify them as needed. Because we 
also looked up this user's SSC information, we can check each 
employee's sAMAccountName as we go through the loop. When 
we find the employee that corresponds to the person SSC says is 
viewing the page, we add a link by the employee's name that 
allows him or her to go to an area to edit the directory informa¬ 
tion. It looks like this: 
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##: Display the directory 

foreach my $entry ($mesg->sorted(’sn')) { 

my $san=$entry->get_value('sAMAccountName'); 
$empdir.="<div class='empcard'>"; 
if(lc($cn) eq lc($san)) { 

##: This is our man. Add a button. 

$empdir. = "<a href='empedit.cgi'>Edit</a>"; 

} 

$empdir.="<span id='name'>"; 

$empdir.=$entry->get_value('givenName')." "; 
$empdir.=$entry->get_value('sn'); 

$empdir.="</span><br>"; 

$empdir. = "<span id ='title'>"; 

$empdir,=$entry->get_value('title'). 

$empdir.="</span><br>"; 

$empdir.="</div>"; 


} 

print STDOUT $empdir; 
$mesg=$ldap->unbind(); 


SpamAssassin and E-mail Integration 

I designed an e-mail gateway for our company back in 2001, 
and it's still the system we use today. I wrote about it in a previous 
Linux Journal article in the December 2001 issue. The system has 
been modified tremendously since then, but it still operates in 
the same basic way. It's simply a store, scan and forward agent. 
Because this all takes place on our Linux server, our Windows users 
were unable to see or retrieve false positives or have any control 
over their SpamAssassin whitelists. We solved this by building a set 
of CGI scripts to let our users modify their SpamAssassin prefer¬ 
ences file and release their false positives from the spam trap on 
their own, using the intranet as the interface. 

Users launch the mail management scripts from their My Intranet 
section on our home page (Figure 2). They choose which day's mail 
they want to view from a drop-down box and click a button to activate 
the selfserv.cgi script. There is no user identity information passed to 
the script, because it will obtain that information from an SSC lookup. 
After we do the initial SSC lookup, we call the getempinfo.pl script 
again to get the current user's e-mail address, like this: 

##: Get this user's email address 
open(GETEMPINFO,"-|,"getempinfo.pi",$cn,"mai1"); 
my $searchstring=<GETEMPINFO>; 
close (GETEMPINFO); 

The $searchstring variable then becomes the base of the regular 
expression we use to search the /spam directory for spam belonging 
to this user. As the mail attribute coming from Active Directory is 
something typed in by human hands, we must do another check to 
make sure we aren't falling victim to typos: 

##: Make sure this email address is valid 
unless($searchstring=~/ A [a-z]*\@domain\.com$/) { 
print STDOUT "Content-Type: text/plain\n\n"; 
print STDOUT "Access Denied: Your identity on \ 
the network can't be verified.\n"; 
return(0); 

} 
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MPI Link-Checker 


A single slow node or intermittent link can cut the speed of MPI applications by half. Whether you use 
GigE, Myrinet, Quadrics, InfiniBand or InfiniPath HTX, there is only one choice for monitoring and 
debugging your cluster of SMP nodes: Microway's MPI Link-Checker™. 

This unique diagnostic tool uses an end-to-end stress test to find problems with cables, processors, 
BIOS's, PCI buses, NIC's, switches, and even MPI itself! It provides instant details on how latency and 
bandwidth vary with packet size. It also provides ancillary data on inter-process and intra-CPU latency, 
and includes FastCheck!, which runs in CLI mode and checks up to 100 nodes per second. 

A complimentary one year license for MPI Link-Checker™ is installed on every Opteron based 
Microway cluster purchased in 2006. 

Wondering what's wrong with your cluster’s performance, or need help designing your next one? 
Microway designs award-winning single and dual core AMD Opteron based clusters. Dual core enables 
users to increase computing capacity without increasing power requirements, thereby providing the best 
performance per watt. Configurations include 1U, 2U, and our4U QuadPuter™ RuggedRack™-available 
with four or eight dual core Opterons, offering the perfect balance between performance and density. 

Microway has been an innovator in HPC since 1982. We have thousands of 
happy customers in HPC, Energy, Enterprise and Life Science markets. 

Isn't it time you became one? 


licroway i 

23 Years of Expertise Built In » ^^ 5^9 


Microway® Quad Opteron™ Cluster with 
36 Opteron 880s, redundant power, 

45 hard drives and Myrinet™ in our 
CoolRak™ cabinet. 


Call us first at 508-746-7341 for quotes and benchmarking 
services. Find technical information, testimonials, and 
newsletter at www.microway.com. 
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If these checks are successful, the script responds by showing 
users the requested day's spam in a table format with a list of 
option links on the side of each item (Figure 3). Users then can use 
the option links to have the script release the spam, whitelist its 
sender, blacklist its sender, produce a SpamAssasin report or simply 
display it as plain text. The script looks up the user's SSC informa¬ 
tion each time it's called and before any action is performed so that 
it knows whether or not to allow that action. I won't get into more 
detail here, because the functions of this script consist mostly of 
just moving files around in response to users' requests. I do want to 
mention the whitelist and blacklist options though. 
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Figure 3. Options for Handling Trapped Spam 

SpamAssassin holds its per-user configuration data in a file 
named .spamassassin/user_prefs.cf in each user's home directory. In 
a normal setup, where Linux is your main mail server, this is fine, 
but in our case, it won't work. Our Linux server is merely a scan¬ 
ning gateway that relays mail in and out, so it has no awareness 
of our users or their e-mail accounts. To solve this, we have to 
cheat a little. SpamAssassin's main configuration file is named 
/etc/mail/spamassassin/local.cf, and it reads this file every time it's 
started. It doesn't read only that file though. It actually reads all 
files in the /etc/mail/spamassasssin directory that have a .cf exten¬ 
sion. We can use this to our advantage and have our CGI script 
create files in this directory for each user's whitelist in a $cn_prefs.cf 
format. We have a cron job that restarts spamd every hour anyway 
to free memory, so this works out fine. The most important thing 
to remember if you use this method is that you have to do strict 
syntax checking to make sure users aren't whitelisting things like 
*@hotmail.com or using any other SpamAssassin directives. Even 
though these files have the appearance of private preference files 
to users, they actually are global to SpamAssassin, because they 
reside in the main config directory. 

Microsoft SQL Server Integration 

Our firm uses a time and billing system called CPAS. This software 
package holds all of our client and billing information as well as 
information used by our marketing manager to assemble mass 
mail-outs to our clients. We wanted to give our users access to this 
information to do some rudimentary data mining without having to 
contact administration every time. Because CPAS stores its informa¬ 
tion in a Microsoft SQL Server database, we had to use a piece of 
software called FreeTDS and the DBD::Sybase package from CPAN 
to interface to it from our Perl CGI scripts. 

Four steps are involved in setting this up. The first thing to do 
is grab the latest FreeTDS package from the Internet and unpack 
the tarball. Next, cd into the unpacked directory, and execute the 
following commands: 

> ./configure --prefix=/usr/local/freetds 


> make 

> su -c ’make install' 

This sets up FreeTDS in its own directory, so it's easier for 
the Sybase module to find later. Next, we go into CPAN and 
get the DBD::Sybase package. Become root and execute the 
following commands: 

> perl -MCPAN -e shell 

> install DBD::Sybase 

Feel free to force the install if some of the tests fail—that is 
pretty common according to the package's author. At this point, 
the software is installed, but we have to set up the FreeTDS 
configuration file. This file holds information about the databases 
to which you will be connecting. The configuration file is well 
documented, and you should be able to figure out the syntax 
easily. Here is a sample server entry: 

[ JACKS0N5] 

host = jackson5.domain.com 

port = 1433 

tds version = 4.2 

Once FreeTDS is configured, you can access your database from 
your CGI scripts through the familiar DBI interface in Perl. Here is 
an example connection to a database called concerts running on 
a Windows server named JACKS0N5: 

#!/usr/bin/perl -w 

use DBI; $ENV{’SYBASE 1 } = ’/usr/local/freetds’; 

$dbh = DBI->connect(’dbi:Sybase:server=JACKS0N5 1 , 'username 1 , 'password') 
or die 'connect'; 

$dbh->do("use concerts"); 

Notice that you have to put the location of your FreeTDS instal¬ 
lation in an environment variable before you attempt a connection. 
The environment variable tells DBD::Sybase where to find the 
FreeTDS libraries. After that, you simply perform your queries as 
usual using DBI. If you are used to working with MySQL, I suggest 
you study up on the syntax used by Microsoft SQL Server. Some of 
it is very different from what you are used to. 

Conclusion 

I hope this article gives you some ideas and practical knowledge 
on how to better integrate your intranet with some of the more 
common systems found in a small business. An intranet shouldn't 
be only a news portal or electronic bulletin board. It should be an 
interactive tool for users and a time-saver for administrators. Users 
feel a level of comfort in a browser environment that they don't 
feel when searching through a filesystem or staring at a command 
line. Take advantage of that and your intranet will become a valuable 
asset to your business. ■ 

Resources for this article: www.linuxjournal.com/article/9270. 


Dave Jones is the IT Manager at Pearce, Bevill, Leesburg & Moore in Birmingham, Alabama. He 
has been a network administrator for eight years. He spends his time blogging and writing software 
at www.sector62.com. 
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Add Web Porn Filtering 
and Other Content Filtering 
to Linux Desktops 

How to set up the DansGuardian content filter with the lightweight Tinyproxy. 

DONALD EMMACK 


Microsoft users continue to adopt the Linux operating system 
and naturally expect to find content filters like the ones they used 
with Windows XP. Often, new Linux converts experiment on their 
standalone personal computers at home. Because many people 
object to some information and images readily found on the Internet, 
a content filtering system is top priority—especially because parents 
often share computers with kids, and constant adult supervision is 
not always possible. 

Using DansGuardian with Tinyproxy is one way parents can super¬ 
vise Internet content when they are away from the family computer. 

A versatile content filter, DansGuardian is open-source software for 
use in a noncommercial setting. If you want to use DansGuardian in 
a commercial setting, you can buy a license or buy SmoothGuardian. 
Working with DansGuardian is Tinyproxy, a small open-source program 
that understands and evaluates the information passing through the 
computer. Together they provide administrative controls to block 
objectionable content from the Internet. 

Content Filtering at 5 r 000 Feet 

DansGuardian is a collection of pass-through filters used to stop 
Internet Web pages with words, phrases and pictures you don't like or 
want others to see. The filters within DansGuardian act as an interme¬ 
diary program between a client browser, like Firefox, and the Internet. 
Firefox makes the information request to DansGuardian. Then, 
DansGuardian passes the information to Tinyproxy, which communi¬ 
cates with the Internet. 

Information coming back from the Internet passes through 
Tinyproxy and DansGuardian before it gets to the client browser. Only 
approved information gets through the filter and appears in the browser 
window. DansGuardian blocks restricted Web pages and replaces the 
unwanted content with an "access denied" security screen displayed 
in the browser window. 

This has not been a high-level description of the filtering proce¬ 
dure. In fact, the way Tinyproxy and DansGuardian work together is 
complex and interesting. If you want to explore how this works, 
check out the DansGuardian "Flow of Events" page (see the on-line 
Resources). Here, you can find a more thorough discussion of filtering 
and how data passes between each program and the Internet. 

What's important to know is you can define many words, phrases 
and specific locations you want DansGuardian to block. In addition to 
Web pages with text, DansGuardian also can filter pictures and prevent 
the downloading of certain files. This combination of filtering is superi¬ 
or to other methods that block access only to a list of banned sites. 

With more than 20 different configuration files, setup of 
DansGuardian can appear complicated to new Linux users. However, 
the configuration files contain clear instructions on how to edit them 
for your needs. In my tests, I didn't need to make a lot of changes, 
because the default filtering arrangement is almost ideal for family use. 


Installation 

First, you need to install and configure DansGuardian and Tinyproxy. 
Second, it's important to adjust your desktop settings to prevent users 
from easily turning off content filtering. 

Before installing, look through the package repository of your 
distribution to make sure it includes DansGuardian and Tinyproxy. 
The most simple way to install the programs is with a GUI package 
manager like Novel SUSE's YaST or Synaptic. For Debian, root users 
enter apt-get install dansguardian tinyproxy. 

If you don't have these applications in your package repository, 
you can download DansGuardian and Tinyproxy from their respective 
Web pages (see Resources). After downloading, you will find generic 
installation instructions in the file named INSTALL. 

Configuring DansGuardian and Tinyproxy 

The next task is to customize configuration files for both Tinyproxy 
and DansGuardian. I use Ubuntu Dapper Drake for testing purposes, 
and so the directory and file illustrations are likely specific to this 
distribution. Other distributions organize files in a similar way; you 
just may need to look a little more to find the installation directory. 
For customizing features, the only tool necessary is a simple text 
editor, such as GNOME'S gedit. 

Using your text editor, as root user, open /etc/dansguardian/ 
dansguardian.conf. Review the file and change filterport, proxyip 
and proxyport to match that shown below. Depending on your 
distribution, it also may be necessary to comment out the line 
starting with UNCONFIGURED: 

# the port that DansGuardian listens to. 
filterport = 8080 

# the ip of the proxy--default is the loopback (this server) 
proxyip = 127.0.0.1 

# the port DansGuardian connects to proxy on 
proxyport = 3128 

DansGuardian generally connects to port 3128 by default, 
because that is the port used by the popular proxy called Squid. 

We can change this to the default port used by Tinyproxy (8888), 
or we can change the Tinyproxy port. In this case, we do the 
latter and change the port Tinyproxy uses to match the default 
Squid port. 

For Tinyproxy, edit the file /etc/tinyproxy/tinyproxy.conf as root 
user. Look through this file, and make sure to change User, Group, 
Port and ViaProxyName, if necessary. The important thing to change 
is the port that Tinyproxy will use to match the DansGuardian connect 
port, which is 3128: 
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# Port to listen on. 

# 

Port 3128 

Once you've finished with these changes, issue the command 
tinyproxy in your terminal, or if Ubuntu-based, type sudo 
/etc/ini t.d/ti nyproxy start. This starts the proxy, and you're 
now ready to finish off the installation by adjusting your browser 
preferences. If you want to learn more, look at the DansGuardian 
documentation links (see Resources) for a description of this process. 

Adjust Your Browser Settings 

Ubuntu comes with Firefox as the preferred client browser, so the 
instructions here are specific to Firefox. Other client browsers will likely 
have similar capabilities and documentation to show how to mimic 
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these instructions. 

This last installation step points the browser at port 8080, so it sends 
data only through DansGuardian and Tinyproxy. With Firefox, go to 
Edit^Preferences-^General tab^Connection Settings to see the screen 
shown in Figure 1. As shown, select manual proxy configuration, enter 
localhost and port 8080. This assumes you are going to install and 
use DansGuardian and Tinyproxy on every workstation. If you set 
up DansGuardian and Tinyproxy on a separate server, then you 
need to enter the name or IP address of the server machine that 
runs DansGuardian and Tinyproxy instead of the word localhost in 
the FHTTP Proxy: line. 

Restart your browser and test how well the filter works. 

When testing the new filter, you should see an access denied 
screen similar to the one shown in Figure 2. Before going any further, 
it's a good idea to look for problems you may find with the default 
filter settings. For example, I often download .tar and other executable 
files. The default configuration file stops these files from download. 
To fix this problem, you need to edit the bannedextensionlist.txt file, 
and place a # to comment out the file extensions you want to let 
through the filter. 

To be thorough, you should look through all default configuration 
.txt files with DansGuardian to tailor how you want the filters to 
react. You won't know all the situations you'll run into at first, 
but this is a good opportunity to gain an understanding of this 
application's powerful features. 

Some Vulnerabilities 

No system is perfect, and there are several obvious ways to defeat 
DansGuardian and Tinyproxy. The most noteworthy is how easily users 
can bypass the proxy and filters. Without further protection, a user can 
restore Firefox's preferences back to Direct Connection, which bypasses 
DansGuardian and Tinyproxy. Once reversed, users have unrestricted 
access to the Internet. 

However, there are more ways to secure the DansGuardian filters 


9 


Uve-iv drill Giuupb 


BSlHT 


Croups | 


U &cr name conic 


Account | Advanced User privileges 



|_J shew all users ar 


© Uel.B 


■ansCuardian an 

herE are some 
nternet throu^ 
hough out met F 

ww.pilpi .iieI / j 
■lan encompass! 
’■anKCiuarrii-an av 



Allow user to: 

C 1 fHW* Hccejjfl to external storage deuces aurtomal:ically 

I I Executing hysluru diclriiiiiib.Lrdl.iuri tasks 

□ Monitor system tons 

□ Stir id dnd receive faxes 

□ Setup printers 

[ ,1 Usu dudiu davit us 

□ use CU-FMJM drwes 
LI Usu Floppy drives 

□ Use scanner devices 

O Use serial tfuviius such u\i Modim* and Pulrn PiltiLii 

□ Use tape drives 

Cl Use tucils tliuL u bL ublish did up cuiinecliunu 

□ Use video acceleration 




@U hI P 




Figure 2. A Typical DansGuardian Access Denied Page 


Figure 3. Ubuntu Dapper Drake User Privilege Settings 
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further by forcing all communication with the Internet through port 
8080. A link on the DansGuardian documentation Web page explains 
a well-thought-out method of using FireHol to force this condition on 
all Internet thoroughfares (see Resources). 

For the novice user, an easier approach is to set up a filtering plan 
that includes restricted user privileges, locked browser preferences and 
making sure the proxy filters start each time the computer reboots. 

For test purposes, I created a new user account on Ubuntu Dapper 
Drake (Figure 3). Using the checklist features, I severely limited the 
capability of the user test. Although these privileges could be just 
right for anyone who has no computer experience or who is plainly 
not trustworthy. Utilities like update-rc.d and fcconf define certain 
programs to start at the system boot. I used a bootup manager called 
BUM to make DansGuardian and Tinyproxy start at each boot. 



Figure 4. Set up DansGuardian and Tinyproxy to run every time you boot Linux. 

Finally, I decided to lock down the preferences of Firefox. 
Restricting Firefox's preferences is not as difficult as it may sound. An 
older copyrighted article titled "HOWTO Lock Down Mozilla Preferences 
for LTSP" by Warren Togami (see Resources) describes how to carry this 
out in great detail. Although, I didn't want to mess with byte shift 
coding to achieve similar results. 

After rummaging through Mozilla.org's Web site, I chose to add 
lockPref statements to my Firefox configuration file to keep users from 
changing connection settings. I edited the file /usr/l i b/f i ref ox/f i ref ox. cf g 
to appear as the one shown in Figure 5. The last three lines force a 
manual proxy selection on localhost, port 8080. After saving this file 
and restarting Firefox, you can't reset the connection settings. Further, 
other users without administrative privileges could not quickly change 
the settings and bypass the filters. 
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Figure 5. Lock down Firefox settings so they can’t be changed without administra¬ 
tive privileges. 

Maintenance 

After customizing the filters to your liking, it's important to realize 
that some settings become stale. Blacklisted sites and new phrases 


are likely to go out of date sooner than others. New Web sites you 
will want to block come on-line often, and new word combina¬ 
tions can make past phrases obsolete. Looking through the Extras 
link on the DansGuardian site, you will find more information on 
blacklists. In addition, several users have contributed scripts to 
automate blacklist generation and update. 

As an alternative, URLblacklist.com allows new users to down¬ 
load their first file free. Afterwards, you can sign up for a periodic 
subscription for access to the latest-and-greatest information. 
Instructions for applying the new data for DansGuardian are on 
the Web site. 

Another consideration is whether the proxy and filter will slow 
down Internet surfing and page loading. Some users will suffer a 
small impact on Web surfing performance when using Tinyproxy. In 
my own testing, I noticed a slight delay, plus a couple of issues with 
my browser cache. Clearing the Firefox cache with Ctrl-Shift-Del 
fixed the cache problems right away. Occasionally, it has been 
necessary to restart Tinyproxy, After doing so, my Internet perfor¬ 
mance improved. Although annoying at times, these small issues 
are acceptable trade-offs. 

Log File Review 

Both DansGuardian and Tinyproxy make log files for administrators to 
review. Within /var/log, you should find directories for DansGuardian 
and Tinyproxy. Using an editor, open the files and search through 
the data to find out what's been happening on the computer. 
Sequentially stored data and clear comment fields make the file 
easier to understand. For DansGuardian, there is a user-contributed 
add-on script for searching and displaying the results in a more 
user-friendly format. 

One feature not found in DansGuardian is the capacity to e-mail 
the log files to a third party for review. This can be a real deterrent 
for some people if they know they have an accountability partner 
watching their actions on the Internet. 

Some Final Thoughts 

Before settling on this solution for content filtering, consider what 
your overall requirements are in the upcoming months. If you have 
only one computer to deal with and you don't mind tinkering 
with configuration files, DansGuardian is probably a good choice. 
Alternatively, SmoothGuardian looks like a great buy for $90 US. 
Plus, the software includes a user-friendly Web-based interface 
and nontechnical installation. 

Nevertheless, setup of DansGuardian and Tinyproxy is well 
within the scope of new Linux users, and the free price fits most 
budgets nicely. Using this article and its references as a guide, 
you shouldn't have too much difficulty getting up and running. 
Even if you do battle a few problems, using Google to search for 
answers is easy. Plus, there is also a Web content filtering portal 
linked to the DansGuardian home page (see Resources) and an 
IRC chat location. 

Overall, DansGuardian and Tinyproxy are frontrunners in the 
Open Source world and help ease the transition from the Microsoft 
Windows environment. I think you'll find flexible filtering and 
lightweight proxy overhead make this a good combination for 
small networking environments. ■ 

Resources for this article: www.linuxjournal.com/article/9291. 


Donald Emmack is Managing Partner of The IntelliGents & Co. He works extensively as a writer and 
business consultant in North America. You can reach him at donald@theintelligents.com or by cruising 
the 2 meter amateur RF bands in the Midwest. 
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Come Together 

Unique innovations are wonderful, but do Linux 
distributions have to differentiate at such low levels? 



Nick Petreley, Editor in Chief 


The whole PC world is plagued by a lack 
of good standards. Some of the most frus¬ 
trating standards problems are hardware- 
related. For example, what brainiac 
thought it was a good idea to make the 
FireWire connectors and USB connectors 
on motherboards identical? The mother¬ 
board manuals are usually careful to point 
out that if you mix these up, you can dam¬ 
age the motherboard. That's nice, but who 
made it possible to mix them up in the 
first place? Dumb. 

It's just as troubling to see a continuing 
lack of good, comprehensive standards 
among Linux distributions. As with hard¬ 
ware, you can almost always find a way to 
make something work if you are careful 
and know what you're doing. But that's 
no excuse for the lack of standards across 
distributions, and the few inadequate 
standards that exist. 

Here's what inspired this complaint. If 
you've been following my columns, you'll 
know that I've been trying to put together a 
MythTV box. I followed several how-to 
pages for installing special drivers for the 
tuner cards I have tried. Most of the pub¬ 
lished instructions, including those linked to 


by some hardware vendors, tell you to place 
firmware everywhere but the place Ubuntu 
stores firmware. Ubuntu looks for firmware 
in the /lib/firmware/<kernel version> directo¬ 
ry. Most instructions tell you to put the 
firmware in /usr/lib/hotplug/firmware. One 
card, the Hauppauge PVR-150/500, wants 
firmware files in multiple locations, includ¬ 
ing the /lib/modules/ directory. It uses dif¬ 
ferent filenames depending on the version 
of the kernel and driver. I've tested three 
cards so far, and I finally ran out of 
patience and used a shotgun approach. 

I put copies of the firmware just about 
everywhere but my son's sock drawer. All 
the drivers work now. I have no idea which 
copies of the firmware files they are find¬ 
ing, but I don't care anymore. 

Personally, I like the Ubuntu approach to 
locating firmware. Ubuntu uses udev, which 
many agree is superior to hotplug. It lets you 
install separate versions of firmware based on 
the version of the kernel. 

Some may argue that this differentia¬ 
tion is what open source is all about. If 
Ubuntu's choice is good enough, other 
distributions will cream-skim it, and it will 
become the standard. Fair enough, but 
wouldn't it be more efficient for customers 
if the distributors simply agreed on such 
fundamentals as udev and where to put 
firmware? At least that way we'd be less 
likely to run across how-to pages that 
don't apply to our chosen distribution. 

As much as I like this one thing about 
Ubuntu, Ubuntu is far from perfect when it 
comes to establishing or observing stan¬ 
dards. Try to install a vanilla kernel on 
Ubuntu and see for yourself. You'll notice 
that you can no longer mount some disk 
partitions. Ubuntu, by default, installs and 
uses a logical volume manager (LVM) and 
enterprise volume management services 
(EVMS), one or both of which break how 
Ubuntu works if you use a vanilla kernel. I 
managed to fix the mount problem by edit¬ 
ing the configuration files for LVM and 
EVMS to ignore all the drives on my sys¬ 
tem. The next version of Ubuntu will add 


ivman, yet another volume manager. I can't 
wait to find out what I'll have to reconfigure 
when the new Ubuntu is ready. 

Unfortunately, my suggestion that dis¬ 
tributors collaborate is utopian and unreal¬ 
istic. They don't even work as a team in 
ways that would benefit them most, such 
as pressuring hardware vendors to preload 
Linux. When it comes to standards, most 
distributors aren't even willing to agree on 
a package format let alone build a package 
system where you could install a Mandriva 
RPM in Fedora without running into depen¬ 
dency problems. They can't agree on where 
to put firmware files or whether EVMS 
should be part of the basic system. 

The best possible solution would be for 
all major distributors to build on a single base 
distribution. This was one of the original 
ideas posed when Linux Standard Base was 
first formed, but distributors rejected the idea 
in spite of the fact that it would save them all 
a lot of duplicated effort. Why are distribu¬ 
tors disinclined to agree on a comprehensive 
standard distribution? Competition. A stan¬ 
dard base distribution would lower the barrier 
of entry for new competing distributions. Put 
more bluntly, despite all the lip service Linux 
distributors give to how their commitment 
to open source and freedom empowers end 
users, they really do like having a degree of 
customer lock-in. Their lock-in just isn't as 
severe, obvious, destructive or effective as 
Microsoft's lock-in. 

Don't get me wrong. I don't want to see 
the Linux market homogenized so much that 
distributions start to disappear. I'm glad there 
are many distributions from which to choose. 

I would simply like to see them differentiate 
their distributions at a much higher level, a 
level that eliminates needless compatibility 
problems. But I confess that there are times 
when frustration leads me to the temptation 
to start a crusade to get everyone to run 
Debian. What do you think?B 


Nicholas Petreley is Editor in Chief of Linux Journal and a former 
programmer, teacher, analyst and consultant who has been working 
with and writing about Linux for more than ten years. 
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Rackspace - Managed Hosting Backed by Fanatical Support 


Fast servers, secure data centers and maximum bandwidth are all 
well and good. In fact, we invest a lot of money in them every year. 
But we believe hosting enterprise class web sites and web 
applications takes more than technology. It takes Fanatical Support. 

Fanatical Support isn't a clever slogan, but the day to day reality our 
customers experience working with us. It's how we have reimagined 
customer service to bring unprecedented responsiveness and value 
to everything we do for our customers. It starts the first time you 
talk with us. And it never ends. 



Thanks for honoring us with the 

2005 Linux Journal Readers' Choice Award for 

"Favorite Web-Hosting Service" 


Contact us to see how Fanatical Support works for you. 

1.888.571.8976 or visit www.rackspace.com 
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flow-through architecture makes it possible to 
create 24 to 72 port modular fabrics which have 
lower latency than monolithic switches. They 


Microway’s FasTree™ DDR InfiniBand switches 
run at 5GHz, twice as fast as the competition’s 
SDR models. FasTree's non-blocking, 



aggregate data modulo 24 instead of 12, improving nearest 

neighbor latency in fine grain problems and doubling the size of the largest three hop fat tree that A 72 Porl FasTree ™ contig 

can be built, from 288 to 576 ports. Larger fabrics can be created linking 576 port domains together. 

Working with QLogic’s InfiniPath InfiniBand Adapters, the number of hops required to move MPI messages between nodes is 
reduced, improving latency. The modular design makes them useful for SDR, DDR and future QDR InfiniBand fabrics, greatly 
extending their useful life. Please send email to fastree@microway.com to request our white paper entitled Low Latency Modular 
Switches for InfiniBand. 



Harness the power of 16 Opteron™ cores and 128 GB in 4U 

Microway’s QuadPute^® includes four or eight AMD dual core Opteron™ processors, 1350 Watt redundant power supply, and up 
to 8 redundant, hot swap hard drives-all in 4U. Dual core enables users to increase computing capacity without increasing power 
requirements, thereby providing the best performance per watt. Constructed with stainless steel, QuadPuter’s RuggedRack™ 
architecture is designed to keep the processors and memory running cool and efficiently. Hard drives are cooled with external air 
and are front-mounted along with the power supply for easy access and removal. The RuggedRack™ with an 8-way motherboard, 


8 drives, and up to 128 GB of memory is an excellent platform for power- and 
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